Description
A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat containernetworking/plugins
all containernetworking/plugins versions before version 0.8.6affected
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10749 ↗
- https://groups.google.com/forum/#%21topic/kubernetes-security-announce/BMb_6ICCfp8 ↗
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00063.html ↗
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00065.html ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DV3HCDZYUTPPVDUMTZXDKK6IUO3JMGJC/ ↗